gd/gd-security.patch

--- gd.c
+++ gd.c
@@ -147,6 +151,7 @@
   }
   memset (im, 0, sizeof (gdImage));
   if (overflow2(sizeof (int *), sy)) {
+    gdFree(im);
     return 0;
   }
   im->tpixels = (int **) gdMalloc (sizeof (int *) * sy);
@@ -2757,6 +2762,8 @@
     }
   bytes = (w * h / 8) + 1;
   im = gdImageCreate (w, h);
+  if (!im)
+    return NULL;
   gdImageColorAllocate (im, 255, 255, 255);
   gdImageColorAllocate (im, 0, 0, 0);
   x = 0;
--- gd_gd.c
+++ gd_gd.c
@@ -149,6 +149,8 @@
     {
       im = gdImageCreate (*sx, *sy);
     }
+  if (!im)
+    goto fail1;
   if (!_gdGetColors (in, im, gd2xFlag))
     {
       goto fail2;